Flasher Secure. Secured Production at Contract Manufacturers. User Guide & Reference Manual

Transcription

1 Flasher Secure Secured Production at Contract Manufacturers User Guide & Reference Manual Document: UM08032 Software Version: 1.0 Revision: 1 Date: May 8, 2018 A product of SEGGER Microcontroller GmbH

2 2 Disclaimer Specifications written in this document are believed to be accurate, but are not guaranteed to be entirely free of error. The information in this manual is subject to change for functional or performance improvements without notice. Please make sure your manual is the latest edition. While the information herein is assumed to be accurate, SEGGER Microcontroller GmbH (SEGGER) assumes no responsibility for any errors or omissions. SEGGER makes and you receive no warranties or conditions, express, implied, statutory or in any communication with you. SEGGER specifically disclaims any implied warranty of merchantability or fitness for a particular purpose. Copyright notice You may not extract portions of this manual or modify the PDF file in any way without the prior written permission of SEGGER. The software described in this document is furnished under a license and may only be used or copied in accordance with the terms of such a license., Hilden / Germany Trademarks Names mentioned in this manual may be trademarks of their respective companies. Brand and product names are trademarks or registered trademarks of their respective holders. Contact address SEGGER Microcontroller GmbH In den Weiden 11 D Hilden Germany Tel. Fax. Internet: support@segger.com

3 3 Manual versions This manual describes the current software version. If you find an error in the manual or a problem in the software, please inform us and we will try to assist you as soon as possible. Contact us for further information on topics or functions that are not yet documented. Print date: May 8, 2018 Software Revision Date AB AB/ Added FlasherSecureServer feature MF AB/ Minor corrections after review MF By Description Initial release.

4 4

5 5 About this document Assumptions This document assumes that you already have a solid knowledge of the following: The software tools used for building your application (assembler, linker, C compiler). The C programming language. The target processor. DOS command line. If you feel that your knowledge of C is not sufficient, we recommend The C Programming Language by Kernighan and Richie (ISBN ), which describes the standard in C programming and, in newer editions, also covers the ANSI C standard. How to use this manual This manual explains all the functions and macros that the product offers. It assumes you have a working knowledge of the C language. Knowledge of assembly programming is not required. Typographic conventions for syntax This manual uses the following typographic conventions: Style Used for Body Body text. Keyword Text that you enter at the command prompt or that appears on the display (that is system functions, file- or pathnames). Parameter Parameters in API functions. Sample Sample code in program examples. Sample comment Comments in program examples. Reference Reference to chapters, sections, tables and figures or other documents. GUIElement Buttons, dialog boxes, menu names, menu commands. Emphasis Very important sections.

6 6

7 7 Table of contents 1 Introduction The concept of the Flasher Secure Flasher Secure overview Features of Flasher Secure Working environment...11 Specifications Specifications for Flasher Secure Flasher Secure download speed Supported Target interfaces Specifications for Flasher Secure Server...14 Security based on emsecure Third party solutions Secure firmware installation (ST) Flasher Secure server Installation Hardware Requirements Connection Requirements Installation on a Linux system Installation on a Windows system Server Certificates...19 Web interface Login Main page Projects Create a new project Project settings User configuration Adding a user account Changing a user account Deleting a user account Firmware Firmware Overview Firmware upload (emsecure) Firmware upload (ST SFI) Firmware settings Manufacturers Add manufacturer account... 34

8 Change a manufacturer account Delete a manufacturer account Reset a manufacturer's success rate counter Devices Devices overview Export Device log Server status Server Access Log Flasher Secure unit Remote control General IP configuration Manual IP configuration IP configuraton with J-Link Configurator IP configuration with integrated web server Project Configuration Configuration files Accessing the configuration files Access via the USB MSD mode Access via FTP Access via ASCII command protocol Programming devices LED status indicators...48 Web interface Flasher Secure main page Flasher Secure network information page Flasher Secure network configuration Flasher Secure system information page Flasher Secure emulator status page Flasher Secure about page Additional Information Patch file support J-Link mode Overview...55 Handshake control ASCII command interface Introduction General command and reply message format General usage Settings for ASCII interface via RS Settings for ASCII interface via Telnet Commands and replies Commands to the Flasher #AUTO #AUTO PATCH #AUTO NOINFO #BAUDRATE<Baudrate> File I/O commands Replies from Flasher Device Firmware emsecure Package Implementing emsecure Package content: Include directories...69 Sample Application...70

9 Hardware and Adapters The main function The _VerifyRSA function...73 The _VerifyECDSA function...73 ARM 20-pin JTAG/SWD Connector Pinout JTAG Pinout SWD Target power supply Flasher RX 14-pin connector Target power supply Flasher PPC 14-pin connector Target board design Pull-up/pull-down resistors RESET, ntrst...81 Adapters JTAG Isolator Pinout J-Link Needle Adapter...83 How to determine the hardware version Support Contacting support Glossary Literature and references...90

10 Chapter 1 Introduction This chapter gives a short overview about the Flasher Secure.

11 11 CHAPTER Flasher Secure overview Flasher Secure overview Flasher is a programming tool for micro controllers with on-chip or external flash memory. Flasher is designed for programming flash targets with the J-Flash software or stand-alone. In addition to that, Flasher Secure can also be used as a regular J-Link. For more information about J-Link in general, please refer to the J-Link / J-Trace User Guide on page 90 In stand-alone mode, Flasher Secure can be driven by the start/stop button. Flasher Secure connects to a PC using the USB/Ethernet/RS232 interface. It can be controlled by handshake control or by ASCII command protocol. USB connection requires the J-Flash tool (for further detail take look into the J-Flash manual on page 90. Flasher Secure always has a 20-pin connector. Many adapters are available. See chapter on page Features of Flasher Secure Three boot modes: J-Link mode, stand-alone mode, MSD mode Stand-alone JTAG, SWD and FINE programmer (Once set up, Flasher Secure can be controlled without the use of PC program). No power supply required, powered through USB Supports internal and external flash devices approximately 128 MB memory for storage of target program Can be used as J-Link (emulator) Data files may be updated via USB/Ethernet (using the J-Flash software), via FTP, via RS232 or via the MSD functionality of Flasher Secure Supported cores Supported target interfaces ARM7/ARM9/Cortex-M JTAG, SWD Flasher model Flasher Secure Flash programming speed (depending on target hardware) between 170 and 300 Kbytes/second Working environment General The Flasher can operate from a PC with an appropriate software like J-Flash or in standalone mode. Host System IBM PC/AT or compatible CPU: 486 (or better) with at least 128MB of RAM, running Microsoft Windows 7, Windows 8, Windows 10. It needs to have a USB, Ethernet or RS232 interface available for communication with Flasher. Power supply Flasher Secure: 5V DC, min. 100 ma via USB connector. Host System Server IBM PC/AT or compatible CPU: 486 (or better) running at 1GHz or faster least 8 GB of RAM Operating System: Microsoft Windows 7, Windows 8, Windows 10 or Linux Ethernet interface available for communication with Flasher Secure. Installing Flasher PC-software (J-Flash) The latest version of the J-Flash software, which is part of the J-Link software and documentation package, can always be downloaded from our website:

12 12 CHAPTER 1 Flasher Secure overview For more information about using J-Flash please refer to UM08003_JFlashARM.pdf (J-Flash user guide) which is also available for download on our website.

13 13 CHAPTER Specifications Specifications Specifications for Flasher Secure General Supported OS Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Windows Windows Windows Windows Windows Windows Operating Temperature +5 C +60 C Storage Temperature -20 C +65 C Relative Humidity (non-condensing) <90% rh 7 7 x x x64 Mechanical Size (without cables) 121mm x 66mm x 30mm Weight (without cables) 119g Available interfaces USB Host interface USB 2.0, full speed Ethernet Host interface 10/100 MBit RS232 Host interface RS232 9-pin Target interface JTAG 20-pin (various adapters available) Target Interface, Electrical Power Supply USB powered, 100mA for Flasher Secure. 500 ma if target is powered by Flasher Secure Target interface voltage (VIF) 1.2 5V Target supply voltage Supply voltage is 5V, max. Target supply current max. 400mA Reset Type Open drain. Can be pulled low or tristated Reset low level output voltage (VOL) VOL 10% of VIF For the whole target voltage range (1.8V VIF 5V) LOW level input voltage (VIL) VIL 40% of VIF HIGH level input voltage (VIH) VIH 60% of VIF For 1.8V VIF 3.6V LOW level output voltage (VOL) with a load VOL 10% of VIF of 10 kohm HIGH level output voltage (VOH) with a load of 10 kohm VOH 90% of VIF For 3.6 VIF 5V LOW level output voltage (VOL) with a load VOL 20% of VIF of 10 kohm HIGH level output voltage (VOH) with a load of 10 kohm VOH 80% of VIF JTAG Interface, Timing Max. JTAG speed up to 15MHz Data input rise time (Trdi) Trdi 20ns

14 14 CHAPTER 1 Specifications Data input fall time (Tfdi) Tfdi 20ns Data output rise time (Trdo) Trdo 10ns Data output fall time (Tfdo) Tfdo 10ns Clock rise time (Trc) Trc 10ns Clock fall time (Tfc) Tfc 10ns Flasher Secure download speed The following table lists the Flasher Secure performance values for writing to memory (RAM) via the JTAG interface: Hardware Flasher Secure ARM memory download ~720 Kbytes/s (15MHz JTAG) Note The actual speed depends on various factors, such as JTAG, clock speed, host CPU core etc Supported Target interfaces The Flasher Secure supports the following target interfaces: JTAG SWD FINE SPD Specifications for Flasher Secure Server General Supported OS Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Linux Windows Windows Windows Windows Windows Windows 7 7 x x x64

15 Chapter 2 The concept of the Flasher Secure The Flasher Secure is a mass production tool, intended to be used at an external manufacturing company. The goal is to protect the intellectual property against unauthorized copying. It consists of a server, which runs in a trusted environment. The server can either be hosted by SEGGER or by yourself. The second part is a client in the form of a Flasher device or a PC application. An IP connection via Internet between the server and the client is mandatory. The following sub-chapters will explain the security concepts of the Flasher Secure solution.

16 CHAPTER 2 Security based on emsecure Security based on emsecure Most of today s devices provide a unique identifier (UID). The UID is factory programmed by the chip vendor and cannot be altered. This characteristic in combination with asymmetric cryptography based on emsecure makes it possible to generate a digital signature unique for each device. The digital signature can be verified by the firmware running on the device, so using the firmware on another device will result in a signature failure. The Flasher Secure server supports emsecure-rsa and emsecure-ecdsa. While emsecure-ecdsa requires slightly less stack RAM compared to emsecure-rsa for verification at the same encryption strength, it significantly performs worse and requires more code space. So we recommend using emsecure-rsa, but it may make sense to use emsecure-ecdsa, if, for example, you are already using it for other purposes.

17 17 CHAPTER Third party solutions Third party solutions Besides the emsecure digital signature solution, the Flasher Secure supports proprietary chip vendor specific solutions. These solutions provide end-to-end encryption: The firmware is decrypted on the target. If you use one of these solutions, there is no need for additional protection via digital signatures over the UID Secure firmware installation (ST) The secure firmware installation process by ST uses a combination of symmetric and asymmetric cryptography. It uses a symmetrically encrypted firmware file, which is decrypted on chip. The chip contains a hidden asymmetric private key and a readable public key. The symmetric key for the decryption of the firmware is encrypted by the server with the chip s public key and sent to the chip together with the encrypted firmware data. The chip s public key additionally is signed by ST, so the server can determine if the public key originates from a real device.

18 Chapter 3 Flasher Secure server The server, as the key component, controls the manufacturing process. It authorizes each produced device, keeps track of the manufacturers and intervenes if they behave in an unusual manner. And it also provides automatic firmware updates to the Flasher Secure clients. The server provides an interface for the Flasher Secure clients and a web interface for administration. Any communication over the network is secured via transport layer security (TLS).

19 19 CHAPTER Installation Installation The Flasher Secure Server is available for the following operation systems: Windows and Linux. Hardware Requirements The following hardware is recommended for the Flasher Secure Server: Hardware part Required minimum Cores 1 Core clock 1 GHz RAM 8 GB Harddrive 32GB (mainly depends on the number of projects and devices) Connection Requirements The Flasher Secure Server requires to be connectable at ports: port 3085 is used for the build in web server providing the user interface. port 3110 is used for the Flasher Secure unit to connect to the server. Installation on a Linux system The Linux installation requires only to follow a few steps: create a user account for the FlasherSecureServer, e.g. FlashSecServ create a directory for your instance of the Flasher Secure Server, e.g. sudo mkdir / opt/segger/flashersecureserver change the owner of the directory, e.g. sudo chown FlashSecServUsr /opt/segger/ FlasherSecureServer, the Flasher Secure Server will put all its data into subdirectories of this root directory. copy the shipment Flasher_Secure_Linux_x64.tar.gz to the created folder extract the shipment in the folder, e.g. tar xvzf Flasher_Secure_Linux_x64.tar.gz create a startup script for your system, e.g. use the sample systemd config file to start the server binary with the correct user account. if you have firewall ensure that the FlasherSecureServer can be reached at the port 3085 and reboot your system or start the FlasherSecureServer application. (note: start the Flasher Secure Server from the installation directory and not with a fully qualified path from else where.) Now everything is ready for the first use Installation on a Windows system Available on request Server Certificates You may generate the required certificates with OpenSSL. A script file for this task is provided in the CERT sub-directory. The server can be used with signed certificates as well as with self-signed certificates. The RSA server certificate can be installed on the Flasher Secure Units (SERVER.CRT). If a certificate file is present on a Flasher Secure unit, the unit will only connect to a server using exactly this certificate effectively preventing man-in-the-middle attacks.

20 20 CHAPTER 3 Installation Note The Flasher Secure units only support RSA. Therefore, the server must be provided at least an RSA certificate. The ECDSA certificate is optional, but can be used for accessing the web interface.

21 21 CHAPTER Web interface Web interface Login The Flasher Secure Server is reachable at The startpage is the login page: The default logins are: Company User name Password Company Admin Admin Company User User The Login levels are: Login Level privileges Admininstrator can read, write and change project and configuration settings. User can only read or view project and configuration settings. The user administration is described in section User configuration on page 26.

22 22 CHAPTER Web interface Main page The main page is the project overview, which shows information on the progress of each project. The navigation is located on the left side. Every category has some subpages, for the provided features and actions.

23 23 CHAPTER Web interface Projects Create a new project The create a new project page creates a new project. Property Meaning Project name A name for the project. This name is used to identify it in the other menus of the server and on the Flasher Secure unit. Maximum number of reprogrammings allowed Defines how often a single device may be reprogrammed. Maximum amount of programming failures Maximum rate of failed device programmings, counted over all programming attempts. Total number of devices Maximum number of devices which can be programmed. Serial number start value First serial number used for programming. SMTP server The server to which Flasher Secure will connect for sending s. SMTP auth username The user name for the account. SMTP auth password The password for the account. Send notifications to user The will be sent to the choosen user. Send notifications for the selected events Manufacturer blocked is send if a manufacturer was blocked event was raised. Project finished is send if the project is finished event was raised.

24 24 CHAPTER Web interface Project settings The project settings page provides basic configuration options to the manufacturing process. The first two options control, how to handle attempts to reprogram an already known device and how to deal with programming failures. The number of reprogramming attempts is limited in order to avoid devices wearing out from too many programming cycles. If a device has been programmed the given times, any further programming attempts will be rejected. In general, for each device the result of the last programming cycle counts. Over all devices, the failure rate can be limited. If a manufacturer exceeds the configured failure rate, the manufacturer s account is disabled upon clarification.

25 25 CHAPTER 3 Web interface The project can be choosen by selecting the project in the marked list and pressing the change button.

26 26 CHAPTER Web interface User configuration The current user configuration is listed on the user configuration page. There are two ways to add user accounts to the Flasher Secure Server: using the web interface and the Add user login page or the configuration file CFG_USER.TXT located in the [installation-directory]/data/ Company. The figure shows a sample user configuration. The red marked user accounts are defined in the configuration file. They cannot be changed or removed within the web interface. The user accounts marked within the green circle can be changed in the web interface. The configuration file contains the default users. There are two access levels: Admin and User. While administrators are allowed to change anything, users only have limited access to configuration settings. Note The Flasher Secure Server is delivered with two default accounts. We recommend to removed them after creating your own accounts.

27 27 CHAPTER Web interface Adding a user account The following properties can be configured: Property Meaning Account User name used for the account. Password Password used for login. address address used for notifications. Login enabled Login is only enabled if checked. User level Admin User has administration access level if checked Changing a user account The user account can be changed anytime. Select the user account by pressing the edit button, see figure. And on the user setting page you can change every setting for the user.

28 28 CHAPTER Web interface Deleting a user account A user account can be deleted anytime. Delete the user account by pressing the delete button, see figure. If you only want to deactivate a user account temporarily, you can set the Login enabled property to disabled on the user configuration page.

29 29 CHAPTER Web interface Firmware Firmware Overview The overview page shows the currently used firmware image properties for the selected project. You can switch between the projects using the drop down list and the change button.

30 30 CHAPTER Web interface Firmware upload (emsecure) This page provides the upload interface for the firmware image files when using the emsecure programming method. The server uses both the private and the public key file to generate and verify a signature. The key files are created by a key generator included in the RSA or ECDSA package. The server automatically detects the encryption standard based on of the key files. Note You need to prepare the firmware image with the JFlash tool for the Flasher Secure outside the Flasher Secure Server. The latest version of the tool is available For the usage of the JFlash tool please read the manual UM08003 available form the same page or this link

31 31 CHAPTER Web interface Firmware upload (ST SFI) This page provides the upload interface for the firmware image files when using ST s SFI programming method. Instead of a regular data file, the firmware is encapsulated in an encrypted container file (SFI file). The server additionally needs the nonce file and the key file in order to create the unique license file required to program the target device. Note You need to prepare the firmware image with a tool available from ST. Please contact ST for more details and the toolkit for SFI flash programming.

32 32 CHAPTER Web interface Firmware settings The Flaser Secure needs to know at which address in the target memory the serial number and the signature should be programmed. These addresses needs to be specified on this page. If the address 0xFFFFFFFF is specified, the corresponding data is not programmed into the device. Note The firmware image file needs to contain some dummy data at the target memory range. Otherwise the data cannot be programmed correctly.

33 33 CHAPTER Web interface Manufacturers This topic allows you to manage your manufacturers. The overview shows all manufacturers for the selected project and the produces device, the OK and failure rates. Note Manufacturer s accounts are not global but linked to one project, so a manufacturer has a separate login to each project. The Flasher Secure Server also keeps track of the used Flasher Secure Devices. Any known Flasher Secure Device, together with manufacturer and date, is shown in the project, where it was used.

34 34 CHAPTER Web interface Add manufacturer account This page provides the possibility to add a manufacturer for a project. Choose the project by using the drop down list and change button. The following properties can be configured: Property Meaning Account User name used for the account or Flasher Secure authentication. Password Password used for login or Flasher Secure authentication. Number of devices Manufacturers quota on devices. Login enabled Login is only enabled if checked. Note Manufacturer s accounts are not global but linked to one project, so a manufacturer has a separate login to each project. The Flasher Secure Server also keeps track of the used Flasher Secure Devices. Any known Flasher Secure Device, together with manufacturer and date, is shown in the project, where it was used.

35 35 CHAPTER Web interface Change a manufacturer account This page provides the possibility to change a manufacturer login. Choose the edit button of the manufacturer you want to alter. The following properties can be configured: Property Meaning Account User name used for the account or Flasher Secure authentication. Password Password used for login or Flasher Secure authentication. Number of devices Manufacturers quota on devices. Login enabled Login is only enabled if checked.

36 36 CHAPTER Web interface Delete a manufacturer account The delete button removes the manufacturer login. You will also lose the statistic of this manufacturer. So it might be more suitable for you only to deactivate the login for this manufacturer in the manufacturer settings (see Change a manufacturer account on page 35) Reset a manufacturer's success rate counter The Reset rate button resets the internal counter for measuring the success rate of the manufacturer. Manufacturer s accounts are disabled automatically, if the manufacturer s yield drops below a specific threshold value set in the project configuration. To re-enable the manufacturer s account, the rate has to be reset using the Reset rate button.

37 37 CHAPTER Web interface Devices Devices overview The devices overview lists all manufactured devices. The list contains for each device the following parameters: running production number, serial number, unique device ID, programming cycles and last programming result. The project can be changed using the drop down list and the change button Export Device log On this page you can export the device log. Supported formats for the report are: csv file or plain text file. Plain text format example: :23:26 - Programming device with unique ID 001B using Flasher 5: OK (1)

38 38 CHAPTER 3 Web interface :13:30 - Programming device with unique ID E using Flasher 11: OK (1) CSV format example: "Date","Device S/N","Device UID","Flasher S/N","Result" " :23:26"," ","47001B ","5","1" " :13:30"," ","4E ","11","1"

39 39 CHAPTER Web interface Server status The server status page gives an overview about the current server status Server Access Log The server s access log, which is also stored on the server as a text file, can be downloaded from the Export logs page. The log file is in the NCSA Common log format. The describtion of the format can be found here: guide/c-logs.html#common Access log sample: [ [ [ [ [ :00:00] 00:00:00] 00:00:00] 00:00:00] 00:00:05] "GET /" "GET /style.css" "GET /img/seggerlogo_200x.png" "GET /favicon.ico" "POST /index.htm"

40 Chapter 4 Flasher Secure unit The Flasher Secure unit is based on the SEGGER Flasher unit, so it generally supports the same devices as the Flashers do. Devices, which do not provide a UID or a vendor specific secure programming solution, are not supported.

41 CHAPTER 4 General General The Flasher Secure unit is the programming unit, which is connected to the target device. Note The Flasher Secure needs an internet connection or network connection. It needs to be able to reach the Flasher Secure Server, which provides the signature generation service.

42 42 CHAPTER IP configuration IP configuration IP configuration is done via DHCP by default. There are different configuration options for setting up a manual configuration: J-Link Configurator (refer to UM08001: J-Link / J-Trace User Guide, chapter 4 Setup, section 4.5 J-Link Configurator), short sum up see here IP configuraton with J-Link Configurator on page 42 J-Link Commander (refer to UM08001: J-Link / J-Trace User Guide, chapter 3 J-Link software and documentation package, section 3.2 J-Link Commander) Flasher Secure web interface (Web interface on page 21). Note The Flasher Secure unit supports IPv4 only Manual IP configuration IP configuraton with J-Link Configurator Start the J-Link Configurator and wait until your Flasher Secure was found. Choose your Flasher Secure in the list, e.g. in the IP connected device list and open the context menu with a right click on the device entry.

43 43 CHAPTER 4 IP configuration Choose the Configure entry in the context menu. Enter the IP configuration in the pop up menu and confirm them using the OK button.

44 44 CHAPTER IP configuration IP configuration with integrated web server Open the browser of your choice. Navigate to your Flasher Secure unit, e.g. Choose the Network configuration page in the navigation column on the left side. Enter your IP configuration on the page and confirm it by pressing the save button. Note The browse my claim the device is no longer preset, when you changed the IP address. In that case you have to reenter the correct IP address in the navigation bar of the browser.

45 45 CHAPTER Project Configuration Project Configuration Configuration files The Flasher Secure unit has an internal and an external storage. The internal storage is about 120MB in size and not accessible from the outside. It is used as cache memory for the firmware and configuration files provided by the server. A 16MB of the internal storage are available for the configuration and log files. The Flasher Secure needs two configuration files SECURE.INI and SERVERT.CRT. A typical configuration file SECURE.INI contains the following information: [SERVER] Host = "FlahserSecureServer.Company.com" Port = "3110" [LOGIN] Company = "Company" Project = "MyProject" Username = "MyManufacturer1" Password = "1234abcd!!!!" Entry Meaning Server section defines the server settings Host the server host name or IP address Port the server port Login section the login setup Company the company name, currently needs to be set to Company (reserved for future feature extension) Project the project name Username the user name for the Flashser Secrue Server login, must be a login of the manufacturers logins. Password the password for the login Note The SERVER section defines the host and the port of the server to connect to. The host may either be a name or an IP address. If it is a name, a DNS server has to be configured in the IP configuration if necessary. The LOGIN section contains the login data corresponding to a manufacturer account on the server. The other configuration file SERVER.CRT is the server s TLS certificate. It is used to restrict the Flasher Secure device to only accept connections to servers using the key in the certificate (server identity pinning). Although this file is optional, we recommend to use it. It provides a simple and fool-proof way to avoid man-in-the-middle attacks. Note The Flasher Secure supports only RSA certificates for the server validation Accessing the configuration files You have three ways to access the configuration files: using the USB MSD mode, using the build-in FTP server and

46 46 CHAPTER Project Configuration using the ASCII command interface over the RS232 connector. Access via the USB MSD mode The 16MB external storage is available as a disk drive, when the Flasher Secure is running in the MSD mode (Mass Storage Device). The Flasher Secure enters this mode, if the button is pressed, you power up the device by connection the USB cable and keep the button pressed for at least 2 seconds Access via FTP The Flahser Secure has a build-in FTP server. So you can connect to it using a FTP client of your choice. The FTP server comes with 2 logins. Login Password Privileges admin 1234 can read, write, upload, download, delete files anonymous none can only read or download files Note These logins cannot be changed Access via ASCII command protocol The files can also be written via the ASCII command protocol. Refer to chapter Commands and replies on page 58 and the included file commands.

47 47 CHAPTER Programming devices Programming devices The Flasher Secure is typically used to program the target devices in a production setup. Therefore it will erase, flash and secure the target devices in on programming cycle once the setup is configured. The Flasher Secure can be controlled by four ways: using the push button on the device, using the 3 wire handshake interface integrated in the RS232 connector or using the ASCII command protocol via RS323 or Telnet. For all Options the details are described in chapter Remote control on page 54. A typically programming cycle may look like this for one target device: Input #AUTO Flasher Secure Response #ACK #STATUS:INITIALIZING #STATUS:INITIALIZING #STATUS:CONNECTING #STATUS:UNLOCKING #STATUS:ERASING #STATUS:PROGRAMMING #STATUS:VERIFYING #OK (Total s, Erase 0.483s, Prog 9.183s, Verify 2.514s)

48 48 CHAPTER LED status indicators LED status indicators Progress and result of an operation is indicated by Flasher Secure s LEDs. The behavior is different for J-Link and stand-alone mode. For a definition of the different modes, please refer to UM08001: J-Link / J-Trace User Guide, chapter Operating modes. The following table describes the behavior of the LEDs in stand-alone mode. # Status of LED Meaning GREEN constant Flasher Secure waits for a start trigger to perform an operation in stand-alone mode. GREEN slow blinking Flashing operation in progress: Erasing (slow blinking on/off time: 80 ms => 6.25 Hz) Programming (slow blinking on/off time: 300ms => ~1.67 Hz) Verifying (slow blinking, on/off time: 100ms => 5 Hz) GREEN: constant RED: off or constant GREEN constant, RED off: Operation successful. GREEN constant, RED constant: Operation failed Goes back to state #0 automatically, but in case of operation failed, RED remains on until state #1 is entered the next time.

49 49 CHAPTER Web interface Web interface The Flasher Secure has a build-in web interface. This interface shows information of the current status and IP configuration of the unit Flasher Secure main page The Flasher Secure main page shows the following information: firmware version, serial number, network configuration and nickname.

50 50 CHAPTER Web interface Flasher Secure network information page The Flasher Secure network information page shows the following information: IP configuration, MAC address, nickname, memory buffer statistic and current network connections. Flasher Secure network configuration The Flasher Secure network configuration allows the setup of the network settings: IP address, subnet mask, gateway IP address and nickname.

51 51 CHAPTER Web interface Flasher Secure system information page The Flasher Secure system information page lists the following points: OS statistic and task statistic. Flasher Secure emulator status page The Flasher Secure emulator status page lists the following points: target voltage (VTref), target power consumption, used target interface and target power and reset status.

52 52 CHAPTER Web interface Flasher Secure about page The Flasher Secure about page lists links to additional information on the SEGGER web presentation.

53 53 CHAPTER Additional Information Additional Information Patch file support This feature is currently not supported by Flasher Secure J-Link mode The Flasher Secure can operate in J-Link mode. For further details please have a look into the J-Link Manual (UM08001). Note In J-Link mode, the Flasher Secure behaves like a normal J-Link. The Flasher Secure programming process, including the signature generation, is only available in standalone mode programming.

54 Chapter 5 Remote control This chapter describes how to control Flasher via the 9-pin serial interface connector or via the integrated Telnet interface.

55 55 CHAPTER Overview Overview There are 4 ways to control Flasher operation: Manual: Programming operation starts when pressing the button. The LEDs serve as visible indicators. Via Handshake lines: 3 lines on the serial interface are used: 1 line is an input and can be used to start operation, 2 lines are outputs and serve as busy and status signals. Terminal communication via RS232. Terminal communication via Telnet. Note All ways to control Flasher operation work only if Flasher is in standalone mode. In JLink or MSD mode they have no effect.

56 56 CHAPTER Handshake control Handshake control The Flasher can be remote controlled by automated testers without the need of a connection to a PC. Therefore the Flasher is equipped with additional hardware control functions, which are connected to the SUBD9 male connector, normally used as RS232 interface to PC. The following diagrams show the internal remote control circuitry of Flasher: Pin No. Function Description 1 START A positive pulse of any voltage between 5 and 30V with duration of min. 30 ms starts Auto function (Clear / Program / Verify) on falling edge of pulse. The behavior of the Auto function depends on the project settings, chosen in J-Flash at the Production tab. 4 BUSY As soon as the Auto function is started, BUSY becomes active, which means that transistor is switched OFF. 5 GND Common Signal ground. 7 OK This output reflects result of last action. It is valid after BUSY turned back to passive state. The output transistor is switched ON to reflect OK state.

57 57 CHAPTER ASCII command interface ASCII command interface Introduction Once set up using J-Flash, the Flasher can be driven by any application or just a simple terminal using ASCII commands. Every known command is acknowledged by the Flasher and then executed. After command execution, Flasher sends an ASCII reply message. Note There are situations where the execution of a known command is rejected with #NACK:ERRxxx if Flasher is currently busy and the received command is not allowed to be sent while Flasher is busy General command and reply message format Any ASCII command has to start with the start delimiter #. Any ASCII command has to end with simple carriage return ( \r, ASCII code 13). Commands can be sent upper or lower case General usage Reply messages must be considered in each case. In general, a new command must not be sent before a reply for the last one has been received Settings for ASCII interface via RS232 Flasher is driven via a RS232 serial port with the following interface settings: 9600 baud 8 data bits no parity 1 stop bit The baud rate can be changed by using the #BAUDRATE command. (see #BAUDRATE on page 59) Settings for ASCII interface via Telnet A client application can connect to Flasher via Telnet on port 23. Find below a screenshot of Flasher which is remote controlled via Telnet:

58 58 CHAPTER ASCII command interface Commands and replies The table below gives an overview about the commands which are supported by the Flasher firmware. Click on the names for a detailed description: Commands to the Flasher Meaning #BAUDRATE<Baudrate> sets the baud rate of the interface #AUTO programs target device #AUTO PATCH patches the binary file and programs target device #AUTO NOINFO programs target device with less output messages #CANCEL cancels a command #ERASE erases the memory #PROGRAM programs the memory #RESULT requests the result of the last action #SELECT <Filename> selects the active project #START starts the device #STATUS requests the current status of the Flasher unit #VERIFY verifies the memory content File I/O commands #FCLOSE closes a file #FCRC calculates the CRC for a file #FDELETE <Filename> deletes a file #FOPEN <Filename> opens a file #FREAD <Offset>,<NumBytes> reads a file #FSIZE requests the file size #FWRITE <Offset>,<NumBytes>:<Data> writes a file #FLIST lists the files #MKDIR <Dirname> creates a directory Replies from the Flasher #ACK answer command acknowledged #NACK answer command not acknowledged #OK answer action finished with status OK #OK:<NumBytes>:<Data> answer requested bytes #OK:<Size> answer requested size #STATUS: answer requested status #ERRxxx answer action finished with error Note Not all commands are supported by all Flasher Types.

59 59 CHAPTER Commands to the Flasher #AUTO ASCII command interface The #AUTO command behaves exactly as the start button or external remote control input. Usually, the following command sequence will be performed when receiving the #AUTO command: The Flasher erases the target CPU (if not blank) The Flasher programs the target CPU The Flasher verifies the target CPU Depending on the settings chosen in the Production tab in J-Flash, this sequence can differ from the one shown above. Finally, Flasher responds with #OK if no error occurred #ERRxxx if any error occurred during operation. xxx represents the error code, normally replied to Flasher PC program. The #ERRxxx message may be followed by an additional error text. During execution of the #AUTO command, Flasher automatically sends status messages via RS232 to reflect the state of execution. Typically during execution of #AUTO command, Flasher will reply the following sequence of messages: #ACK #STATUS:INITIALIZING #STATUS:CONNECTING #STATUS:UNLOCKING #STATUS:ERASING #STATUS:PROGRAMMING #STATUS:VERIFYING #OK (Total s, Erase 0.483s, Prog 9.183s, Verify 2.514s) #AUTO PATCH The #AUTO PATCH command allows patching of the content of the data to be programmed. Flasher responds with #OK if no error occurred #ERRxxx if any error occurred during operation. xxx represents the error code, normally replied to Flasher PC program. The #ERRxxx message may be followed by an additional error text. Note This feature is not supported by the Flasher Secure. For further information about the usage of the #AUTO PATCH command please refer to Patch file support on page #AUTO NOINFO This command may be used instead of #AUTO, if no status messages from Flasher should be sent during execution. The NOINFO extension is also available for all other commands. The command ends with #OK or #ERRxxx #BAUDRATE<Baudrate> This command can be sent in order to change the baud rate of the Flasher s RS232 interface used for communication. <Baudrate> is expected in decimal format. The valid range is from 2400 baud to baud.

60 60 CHAPTER 5 ASCII command interface If this command succeeds, Flasher responds with: #ACK #OK Otherwise it will respond with one of the following error messages: #ERR255: Invalid parameters or #ERR255: Baudrate is not supported Note After sending the #BAUDRATE command you will first have to wait until the Flasher responds with the #OK message. It is recommended wait 5ms before sending the next command with the new baud rate in order to give the Flasher the time to change the baud rate. #CANCEL This command can be sent to abort a running program. It may take a while until the current program is actually canceled. Flasher will respond with: #ERR007:CANCELED. #ERASE This command can be sent to erase all selected target flash sectors. Flasher will reply the following sequence of messages: #ACK #STATUS:INITIALIZING #STATUS:CONNECTING #STATUS:UNLOCKING #STATUS:ERASING #OK (Total 0.893s, Erase 0.483s) #PROGRAM This command can be used instead of #AUTO to program a target without erasing the target before programming and without performing a final verification. #RESULT This command can be sent any time, even during other command execution. Flasher responds with the last result of the previously executed command. #SELECT <Filename> The #SELECT command is used to select a specific config and data file pair which should be used by Flasher to program the target. <Filename> specifies the name of file pair without extensions (.CFG and.dat) on the Flasher which should be selected. Flasher saves the selected config and data file in the FLASHER.INI file. So this selection is remembered even between power-cycling Flasher. This may be verfy helpful in cases where several config and data files are stored on Flasher. The user can easily switch between these config and data files without connecting Flasher to a host. If this command succeeds, Flasher responds with: #ACK #OK Find below a sample sequence which shows how to use the #SELECT command:

61 61 CHAPTER 5 #SELECT ATSAM7_1 // ATSAM7_1.CFG #ACK #OK #AUTO // Start auto programming #ACK #STATUS:INITIALIZING #STATUS:CONNECTING #STATUS:UNLOCKING #STATUS:ERASING #STATUS:PROGRAMMING #STATUS:VERIFYING #OK (Total 8.416s, Erase 0.005s, #SELECT ATSAM7_2 // ATSAM7_2.CFG #ACK #OK #AUTO // Start auto programming #ACK #STATUS:INITIALIZING #STATUS:CONNECTING #STATUS:UNLOCKING #STATUS:ERASING #STATUS:PROGRAMMING #STATUS:VERIFYING #OK (Total 8.632s, Erase 0.005s, ASCII command interface and ATSAM7_1.DAT is selected Prog 6.845s, Verify 0.959s) and ATSAM7_2.DAT is selected Prog 7.051s, Verify 0.969s) #START This command can be sent to release Flasher s target interface. All signals from Flasher to target will be set into high-z mode, reset of target will be released. It may be used to start target application program. Flasher will reply with the following sequence of messages: #ACK #STATUS:INITIALIZING #STATUS:CONNECTING #OK (Total 1.148s) #STATUS This command can be sent any time, even during other command execution. Flasher responds with its current state. All defined state messages are described under Replies from Flasher on page 64. #VERIFY This command can used to verify the target flash content against the data stored in Flasher File I/O commands The ASCII interface of the Flasher also supports file I/O operations. The following file I/O commands are supported: #FCLOSE The #FCLOSE command closes the file on Flasher which was opened via #FOPEN. After this command has been issued further file I/O operations except #FDELETE are not allowed until the #FOPEN command is send again. A typical sequence when using the #FCLOSE command does look like as follows: #FCLOSE #ACK #OK

62 62 CHAPTER 5 ASCII command interface Note When using the #FCLOSE command a file has to be open (previously opened by #FOPEN). Otherwise Flasher will respond with the following if no file has been opened: #ACK #ERR255:No file opened #FCRC The #FCRC command calculates a 32-bit CRC of the given file. This CRC can be used to verify file integrity. This command should not be used while a file has been opened via #FOPEN. The CRC will be also reported by J-Flash when downloading or saving files via J-Flash. A typical sequence when using the #FCRC command does look like as follows: #FCRC flasher.dat #ACK #OK:0x75BC855A #FDELETE <Filename> The #FDELETE command is used to delete a file on Flasher where <Filename> specifies the name of the file. A typical sequence when using the #FDELETE command does look like as follows: #FDELETE flasher.dat #ACK #OK Note If deletion of the file fails for example if the file does not exist, Flasher will respond with the following sequence: #ACK #ERR255:Failed to delete file #FOPEN <Filename> The #FOPEN command is used to open a file on Flasher for further file I/O operations. <Filename> specifies the file on the Flasher which should be opened. If <Filename> can not be found on Flasher a new one will be created. A typical sequence using the #FOPEN command does look like as follows: #FOPEN flasher.dat #ACK #OK Note Currently only one file can be open at the same time. If #FOPEN is send and another file is already open, Flasher will respond with: #ACK #ERR255:A file has already been opened

63 63 CHAPTER 5 ASCII command interface #FREAD <Offset>,<NumBytes> The #FREAD command is used to read data from a file on Flasher. <Offset> specifies the offset in the file, at which data reading is started. <NumBytes> specifies the number of bytes which should be read. A typical sequence when using the #FREAD command does look like as follows: #FREAD 0,4 #ACK #OK:04:466c6173 If the #FREAD command succeeds, Flasher will finally respond with a #OK:<NumBytes>:<Data> reply message. For more information about the Flasher reply messages, please refer to Replies from Flasher on page 64. Note In order to use the #FREAD command. A file has to be opened before, via the #FOPEN command. Otherwise Flasher will respond with the following sequence: #ACK #ERR255:No file opened #FSIZE The #FSIZE command is used to get the size of the currently opened file on Flasher. A typical sequence when using the #FSIZE command does look like as follows: #FSIZE #ACK #OK:10 // file on flasher which is currently open, has a size of 16 bytes If the #FSIZE command succeeds, Flasher will respond with a #OK:<Size> reply message. For more information about the Flasher reply messages, please refer to Replies from Flasher on page 64. Note In order to use the #FREAD command. A file has to be opened before, via the #FOPEN command. Otherwise Flasher will respond with the following sequence: #ACK #ERR255:No file opened #FWRITE <Offset>,<NumBytes>:<Data> The #FWRITE command is used to write to a file on Flasher. <Offset> specifies the offset in the file, at which data writing is started. <NumBytes> specifies the number of bytes which are send with this command and which are written into the file on Flasher. <NumBytes> is limited to 512 bytes at once. This means, if you want to write e.g bytes, you have to send the #FWRITE command twice, using an appropriate offset when sending it the second time. <Offset> and <NumBytes> are expected in hexadecimal format. #FWRITE 0,200:<Data> #FWRITE 200,200:<Data> The data is expected in hexadecimal format (two hexadecimal characters per byte). The following example illustrates the use of #FWRITE: Data to be send: Hello! ASCII values: 0x48, 0x65, 0x6C, 0x6C, 0x6F, 0x20, 0x21

64 64 CHAPTER 5 ASCII command interface #FWRITE 0,7:48656C6C6F2021 Note In order to use the #FWRITE command a file has to be opened via the #FOPEN command, first. Otherwise Flasher will respond with the following sequence: #ACK #ERR255:No file opened #FLIST The #LIST command is used to list all files stored on the Flasher. A typical sequence using the #FLIST command does look like as follows: #FLIST #ACK FLASHER.INI Size: 60 SERIAL.TXT Size: 3 FLASHER.LOG Size: 207 FOLDER (DIR) FOLDER\TEST1.CFG Size: 2048 FOLDER\TEST1.DAT Size: #OK #MKDIR <Dirname> The #MKDIR command is used to create a directory on Flasher. <Dirname> specifies the name of the new directory. <Dirname> may also specify a path to create a subdirectory. A typical sequence using the #MKDIR command does look like as follows: #MKDIR folder #ACK #OK Note If the directory can not be created because of a bad <Dirname> argument, Flasher will respond with: #ACK #ERR255:Failed to create directory Replies from Flasher The reply messages from Flasher follow the same data format as commands. Any reply message starts with ASCII start delimiter #, ends with simple carriage return (ASCII code 13) and is sent in uppercase. In contrast to commands, replies can be followed by a descriptive message, which gives more detailed information about the reply. This description is sent in mixed case. The #OK reply, for example, is such a reply. It is followed by a string containing information about the performance time needed for the operations: #OK (Total s, Erase 0.483s, Prog 9.183s, Verify 2.514s) The following reply messages from Flasher are defined: #ACK Flasher replies with #ACK message on reception of any defined command before the command itself is executed.

65 65 CHAPTER 5 ASCII command interface #NACK Flasher replies with #NACK, if an undefined command was received. #OK Flasher replies with #OK, if a command other than #STATUS or #RESULT was executed and ended with no error. #OK:<NumBytes>:<Data> Flasher replies with #OK:<Len>:<Data> if a #FREAD command was executed. <NumBytes> is the number of bytes which could be read. This value may differ from the number of requested bytes, for example if more bytes than available, were requested. <NumBytes> and <Data> are send in hexadecimal format (for <Data>: two hexadecimal characters per byte). #OK:<Size> Flasher replies if #OK:<Size> if a #FSIZE command has been executed. <Size> is the size (in bytes) of the currently opened file. <Size> is send in hexadecimal format. #STATUS: The Flasher replies with its current state. The following status messages are currently defined: Message Description #STATUS:READY Flasher is ready to receive a new command. #STATUS:CONNECTING Flasher initializes connection to target CPU. #STATUS:INITIALIZING Flasher performs self check and internal init. #STATUS:UNLOCKING Unlocking flash sectors. #STATUS:ERASING Flasher is erasing the flash of the target device. #STATUS:PROGRAMMING Flasher is programming the flash of the target device. #STATUS:VERIFYING Flasher verifies the programmed flash contents. #ERRxxx If any command other than #STATUS or #RESULT was terminated with an error, Flasher cancels the command and replies with an error message instead of #OK message. Some error codes may be followed by colon and an additional error text. For example: #ERR007:CANCELED. The error code numbers are described in the following table: Message Description #ERR007 Flasher received #CANCEL command and has canceled the current operation. #ERR008 Flasher is already busy with execution of previous command. #ERR009 Failed to allocate memory.

66 66 CHAPTER 5 Message ASCII command interface Description #ERR010 Failed to open file. #ERR011 Failed to read file. #ERR012 Failed to write file. #ERR013 Failed to delete file. #ERR255 Undefined error occurred. This reply is followed by an error string.

67 Chapter 6 Device Firmware The firmware of the target device needs to implement the emsecure software package. The security features of the emsecure software package are used to verify if the flashed device signature is valid or not.

68 CHAPTER 6 emsecure Package emsecure Package The emsecure comes with a detailed documentation itself. Therefore there are only the main topic described in this manual. For the details about the emsecure library take a closer look into the UM12002 emsecure RSA or UM emsecure ECDSA manual.

69 69 CHAPTER Implementing emsecure Implementing emsecure The the emsecure software package is part of the Flasher Secure shipment Package content: emsecure is provided in source code and contains everything needed. The following table shows the content of the emsecure package: Files Description Application sample applications for bare metal and embos. Config Configuration header files. Doc emsecure documentation. CRYPTO Shared cryptographic library source code. SECURE emsecure implementation code. SEGGER SEGGER software component source code used in emsecure. Sample/Config Example emsecure configuration. Sample/Keys Example emsecure key pairs. Windows Supporting applications in binary and source form Include directories You should make sure that the include path contains the following directories (the order of inclusion is of no importance): Config CRYPTO\Inc SECURE\Inc SEGGER SETUP You should add the source files from the following directories to your project: CRYPTO SECURE SEGGER SETUP\Crypto Note Always make sure that you have only one version of each file! It is frequently a major problem when updating to a new version of emsecure-rsa if you have old files included and therefore mix different versions. If you keep emsecure-rsa in the directories as suggested (and only in these), this type of problem cannot occur. When updating to a newer version, you should be able to keep your configuration files and leave them unchanged. For safety reasons, we recommend backing up (or at least renaming) the SECURE directories before updating.

70 CHAPTER 6 Sample Application Sample Application The Flasher Secure is shipped with a sample application which looks like the listed example below. Note The sample application is build based on the embos OS. emsecure library can be used without / SEGGER Microcontroller GmbH & Co. KG The Embedded Experts (c) SEGGER Microcontroller GmbH & Co. KG Support: support@segger.com embos Real time operating system for microcontrollers Please note: Knowledge of this file may under no circumstances be used to write a similar product or a real-time operating system for in-house use. Thank you for your fairness! File : FlasherSecureVerifyExample.c Purpose : Example code for UID signature check END-OF-HEADER / #include "RTOS.h" #include "BSP.h" #include "stm32l0xx.h" #include "SECURE_RSA.h" #include "SECURE_ECDSA.h" #include "RSA_PrivateKey.h" #include "RSA_PublicKey.h" #include "ECDSA_PrivateKey.h" #include "ECDSA_PublicKey.h" int printf(const char fmt,...); / Defines, fixed / // // Unique device ID register (96 bits) //

71 71 CHAPTER 6 typedef struct volatile U32 volatile U32 volatile U32 } UID_Type; Sample Application { UID_0; UID_1; UID_2; #define UID ((UID_Type )0x1FF80050) / Defines, configurable / // choose the used cryptographic methode here! //#define ECDSA 1 // Use ECDSA #define RSA 1 // Use RSA / Static data / static OS_STACKPTR int StackHP[128]; static OS_TASK TCBHP; / task stack / / task control block / static const volatile U8 attribute ((section (".otp.sig"))) _asignature[256] = { [ ] = 0xFF }; static const volatile U64 attribute ((section (".otp.sn"))) _SerialNo = 0xFFFFFFFFFFFFFFFF; / Local functions / static void _HexDump(const U8 Data, int NumBytes) { int i; for (i = 0; i < NumBytes; i++) { if (!(i % 16)) { printf("\n"); } else if (!(i % 4)) { //printf(" "); } //printf ("%.2X", Data); printf ("0x%.2X, ", Data); Data++; } printf("\n"); } #ifdef RSA static int _VerifyRSA(unsigned char ID, int NumBytes, int SigBytes) { return SECURE_RSA_Verify(&_RSAPublicKey, 0, 0, ID, NumBytes, (U8)_aSignature, SigBytes); } #endif #ifdef ECDSA static int _VerifyECDSA(unsigned char ID, int NumBytes, int SigBytes) { SECURE_ECDSA_PUBLIC_KEY PublicKey = { _ECDSAPublicKey, &SECURE_ECDSA_CURVE_P192 }; return SECURE_ECDSA_Verify(&PublicKey, ID, NumBytes, (U8)_aSignature, SigBytes); } #endif

72 72 CHAPTER 6 Sample Application / HPTask / static void HPTask(void) { while (1) { BSP_ToggleLED(0); OS_Delay (50); } } / Global functions / / MainTask() / #ifdef cplusplus extern "C" { / Make sure we have C-declarations in C++ programs / #endif void MainTask(void); #ifdef cplusplus } #endif void MainTask(void) { char FW_OK = 0; // check result U8 ID[16]; // 16 Bytes UID U32 t0; // time measuring t0 = OS_GetTime(); printf("unique device ID:\n%.8X %.8X %.8X\n", UID->UID_0, UID->UID_1, UID>UID_2); SEGGER_memcpy(&ID[0], (U8)UID, 12); memset(&id[12], 0, 4); // zero padding printf("combined device ID:"); _HexDump(ID, sizeof(id)); printf("\n"); printf("serial number: %lld", _SerialNo); printf("\n"); #ifdef RSA if (_VerifyRSA(ID, sizeof(id), 256) > 0) { printf("verified UID is correctly signed... (%dms)\n", OS_GetTime() - t0); FW_OK = 1; } else { printf("signed UID did not verify... ERROR! } printf("\nsignature:"); _HexDump((U8)_aSignature, 256); printf("\n"); #endif #ifdef ECDSA if (_VerifyECDSA(ID, sizeof(id), 48) > 0) { printf("verified UID is correctly signed... (%dms)\n", OS_GetTime() - t0); FW_OK = 2; } else { printf("signed UID did not verify... ERROR! } printf("\nsignature:"); SUCCESS! (%dms)\n", OS_GetTime() - t0); SUCCESS! (%dms)\n", OS_GetTime() - t0);

73 73 CHAPTER 6 Sample Application _HexDump((U8)_aSignature, 48); printf("end.\n", OS_GetTime() - t0); #endif if (FW_OK) { // // Firmware main task // OS_CREATETASK(&TCBHP, "HPTask", HPTask, 150, StackHP); } OS_TerminateTask(NULL); } / End of file / Features of the example: initializes the hardware required for the example, reads the unique ID of the device and verifies the signature of the device. The main function The main function calls the required functions to get the unique ID, verify it and react to the result. Depending on the choosen cryptographic methode the _VerifyRSA or the _VerifyECDSA function is called. The FW_OK variable contains the verification result and the firmware main functions, here repesented by the HPTask, are started is it is set to a value greater then 1. Otherwise the signature check failed and the firmware is not started The _VerifyRSA function If the RSA methode is choosen as cryptographic methode this function will check the signature of the given UID. It calls the corresponding emsecure library function and will report the result The _VerifyECDSA function If the ECDSA methode is choosen as cryptographic methode this function will check the signature of the given UID. It calls the corresponding emsecure library function and will report the result. Note The Flasher Secure software package includes either the RSA or the ECDSA cryptographic library.

74 Chapter 7 Hardware and Adapters This chapter gives an overview about Flasher Secure specific hardware details, such as the pinouts and available adapters.

75 75 CHAPTER ARM 20-pin JTAG/SWD Connector ARM 20-pin JTAG/SWD Connector Flasher Secure has a JTAG connector compatible with ARM JTAG standard. The JTAG connector is a 20 way Insulation Displacement Connector (IDC) keyed box header (2.54mm male) that mates with IDC sockets mounted on a ribbon cable Pinout JTAG The following table lists the JTAG pinout. PIN SIGNAL TYPE Description 1 VTref Input This is the target reference voltage. It is used to check if the target has power, to create the logic-level reference for the input comparators and to control the output logic levels to the target. It is normally fed from Vdd of the target board and must not have a series resistor. 2 Vsupply NC This pin is not connected to Flasher Secure. It is reserved for compatibility with other equipment. Connect to Vdd or leave open in target system. 3 ntrst Output JTAG Reset. Output from Flasher Secure to the Reset signal of the target JTAG port. Typically connected to ntrst of the target CPU. This pin is normally pulled HIGH on the target to avoid unintentional resets when there is no connection. 5 TDI Output JTAG data input of target CPU. It is recommended that this pin is pulled to a defined state on the target board. Typically connected to TDI of target CPU. 7 TMS Output JTAG mode set input of target CPU. This pin should be pulled up on the target. Typically connected to TMS of target CPU. 9 TCK Output JTAG clock signal to target CPU. It is recommended that this pin is pulled to a defined state of the target board. Typically connected to TCK of target CPU. 11 RTCK Input Return test clock signal from the target. Some targets must synchronize the JTAG inputs to internal clocks. To assist in meeting this requirement, you can use a returned, and retimed, TCK to dynamically control the TCK rate. Flasher Secure supports adaptive clocking, which waits for TCK changes to be echoed correctly before making further changes. Connect to RTCK if available, otherwise to GND. 13 TDO Input JTAG data output from target CPU. Typically connected to TDO of target CPU. 15 RESET I/O Target CPU reset signal. Typically connected to the RESET pin of the target CPU, which is typically called nrst, nreset or RESET.

76 76 CHAPTER 7 PIN SIGNAL 17 DBGRQ 19 5V-Target supply TYPE ARM 20-pin JTAG/SWD Connector Description NC This pin is not connected in Flasher Secure. It is reserved for compatibility with other equipment to be used as a debug request signal to the target system. Typically connected to DBGRQ if available, otherwise left open. Output This pin is used to supply power to some eval boards. Typically left open on target hardware. Pins 4, 6, 8, 10, 12, 14, 16, 18, 20 are GND pins connected to GND in Flasher Secure. They should also be connected to GND in the target system Pinout SWD The 20-pin connector of Flasher Secure is also compatible to ARM s Serial Wire Debug (SWD) interface. The following table lists the SWD pinout. PIN SIGNAL TYPE Description 1 VTref Input This is the target reference voltage. It is used to check if the target has power, to create the logic-level reference for the input comparators and to control the output logic levels to the target. It is normally fed from Vdd of the target board and must not have a series resistor. 2 Vsupply NC This pin is not connected in Flasher Secure. It is reserved for compatibility with other equipment. Connect to Vdd or leave open in target system. 3 Not Used NC This pin is not used by Flasher Secure. If the device may also be accessed via JTAG, this pin may be connected to ntrst, otherwise leave open. 5 Not used NC This pin is not used by Flasher Secure. If the device may also be accessed via JTAG, this pin may be connected to TDI, otherwise leave open. 7 SWDIO I/O Single bi-directional data pin. Output Clock signal to target CPU. It is recommended that this pin is pulled to a defined state of the target board. Typically connected to TCK of target CPU. 11 Not used NC This pin is not used by Flasher Secure. This pin is not used by Flasher Secure when operating in SWD mode. If the device may also be accessed via JTAG, this pin may be connected to RTCK, otherwise leave open. 13 SWO Output Serial Wire Output trace port. (Optional, not required for SWD communication.) 9 SWCLK

77 77 CHAPTER 7 PIN SIGNAL TYPE ARM 20-pin JTAG/SWD Connector Description 15 RESET I/O Target CPU reset signal. Typically connected to the RESET pin of the target CPU, which is typically called nrst, nreset or RESET. 17 Not used NC This pin is not connected in Flasher Secure. Output This pin is used to supply power to some eval boards. Not all J-Links supply power on this pin, only the KS (Kickstart) versions. Typically left open on target hardware. 19 5V-Target supply Pins 4, 6, 8, 10, 12, 14, 16, 18, 20 are GND pins connected to GND in Flasher Secure. They should also be connected to GND in the target system Target power supply Pin 19 of the connector can be used to supply power to the target hardware. Supply voltage is 5V, max. current is 400mA. The output current is monitored and protected against overload and short-circuit. Power can be controlled via the J-Link commander. The following commands are available to control power: Command Explanation power on Switch target power on power off Switch target power off power on perm Set target power supply default to on power off perm Set target power supply default to off

78 78 CHAPTER Flasher RX 14-pin connector Flasher RX 14-pin connector Flasher Secure itself has a 20-pin JTAG connector mounted but an optional J-Link 14-pin RX adapter is available. This adapter enables Flasher Secure to optionally power the connected target hardware. On the adapter there is a jumper which allows selection between 3.3V and 5V supply target voltage supply. The target is supplied via the VTref connection when the supply option is jumpered. The following table lists the J-Link RX 14-pin JTAG pinout. Pin 1 3 Signal TCK TRSTn Type Description Output JTAG clock signal to target CPU. It is recommended that this pin is pulled to a defined state on the target board. Typically connected to TCK on target CPU. Output JTAG Reset. Output from Flasher Secure to the Reset signal of the target JTAG port. Typically connected to ntrst of the target CPU. This pin is normally pulled HIGH on the target to avoid unintentional resets when there is no connection. 4 EMLE Output Pin for the on-chip emulator enable signal. When the on-chip emulator is used, this pin should be driven high. When not used, it should be driven low. Pulled HIGH to VTref via 1k pull-up resistor on 14-pin adapter. 5 TDO Input JTAG data output from target CPU. Typically connected to TDO on target CPU. 6 NC This pin is not connected to Flasher Secure. 7 NC This pin is not connected to Flasher Secure. 8 VTref Input This is the target reference voltage. It is used to check if the target has power, to create the logic-level reference for the input comparators and to control the output logic levels to the target. It is normally fed from Vdd of the target board and must not have a series resistor. 9 TMS Output JTAG mode set input of target CPU. This pin should be pulled up on the target. Typically connected to TMS on target CPU. 10 NC This pin is not connected to Flasher Secure. 11 TDI Output JTAG data input of target CPU. It is recommended that this pin is pulled to a defined state on the target board. Typically connected to TDI on target CPU. 13 nres I/O Target CPU reset signal. Typically connected to the RESET pin of the target CPU, which is typically called nrst, nreset or RESET. All pins marked NC are not connected to Flasher Secure. Any signal can be applied here; Flasher Secure will simply ignore such a signal. Pins 2, 12, 14 are GND pins connected to GND in Flasher Secure. They should also be connected to GND in the target system.

79 79 CHAPTER Flasher RX 14-pin connector Target power supply Pin 8 of the 14-pin connector can be used to supply power to the target hardware. Supply voltage is 3.3V / 5V, max. current is 400mA. The output current is monitored and protected against overload and short-circuit. Power can be controlled via the J-Link commander. The following commands are available to control power: Command Explanation power on Switch target power on power off Switch target power off power on perm Set target power supply default to on power off perm Set target power supply default to off

80 80 CHAPTER Flasher PPC 14-pin connector Flasher PPC 14-pin connector Flasher Secure itself has a 20-pin JTAG connector mounted but an optional 14-pin PPC adapter for PowerPC devices is available. The following table lists the J-Link PPC 14-pin adapter JTAG pinout. Pin Signal Type Description 1 TDI Output JTAG data input of target CPU. It is recommended that this pin is pulled to a defined state on the target board. Typically connected to TDI on target CPU. 3 TDO Input JTAG data output from target CPU. Typically connected to TDO on target CPU. 5 TCK Output JTAG clock signal to target CPU. It is recommended that this pin is pulled to a defined state on the target board. Typically connected to TCK on target CPU. 7 NC This pin is not connected to Flasher Secure. 8 NC This pin is not connected to Flasher Secure. 9 nres I/O Target CPU reset signal. Typically connected to the RESET pin of the target CPU, which is typically called nrst, nreset or RESET. Output JTAG mode set input of target CPU. This pin should be pulled up on the target. Typically connected to TMS on target CPU. 11 VDDE7 Input This is the target reference voltage. It is used to check if the target has power, to create the logic-level reference for the input comparators and to control the output logic levels to the target. It is normally fed from Vdd of the target board and must not have a series resistor. 13 nrdy Input Nexus ready output. Indicates to the development tools that the data is ready to be read from or written to the Nexus read/write access registers. Output JTAG TAP Controller Enable / JTAG Compliancy (JCOMP). JCOMP is used to enable the TAP controller for communication to the JTAG state machine for boundary scan and for debug access. This pin is set to HIGH by Flasher Secure (in order to enable the JTAG TAP controller on the target device). 10 TMS 14 JCOMP All pins marked NC are not connected to Flasher Secure. Any signal can be applied here; Flasher Secure will simply ignore such a signal. Pins 2, 12, 6, 12 are GND pins connected to GND in Flasher Secure. They should also be connected to GND in the target system.

81 81 CHAPTER Target board design Target board design We strongly advise following the recommendations given by the chip manufacturer. These recommendations are normally in line with the recommendations. Please refer to the the appropriate tables depending on the core: Pinout JTAG on page 75 Pinout SWD on page 76 J-Link RX 14-Pin Adapter, J-Link RX FINE 14-Pin Adapter on page 78 J-Link PPC 14-Pin Adapter on page 80 In case of doubt you should follow the recommendations given by the semiconductor manufacturer Pull-up/pull-down resistors Unless otherwise specified by developer s manual, pull-ups/pull-downs are recommended to be between 2.2 kohms and 47 kohms RESET, ntrst The debug logic is reset independently from the CPU core with ntrst. For the core to operate correctly it is essential that both signals are asserted after power-up. The advantage of having separate connection to the two reset signals is that it allows the developer performing software debug to setup breakpoints, which are retained by the debug logic even when the core is reset. (For example, at the reset vector address, to allow the code to be single-stepped as soon as it comes out of reset). This can be particularly useful when first trying to bring up a board with a new ASIC.

82 82 CHAPTER Adapters Adapters JTAG Isolator The JTAG Isolator can be connected between Flasher and JTAG adapter, to provide electrical isolation. This is essential when the development tools are not connected to the same ground as the application. For more information about the JTAG Isolator, please refer to JLink JTAG Isolator User Manual (UM08010) which can be downloaded from our website Pinout The following table shows the target-side pinout of the J-Link JTAG Isolator. Pin Signal Type Description 1 VCC Output The target side of the isolator draws power over this pin. 2 VCC Output The target side of the isolator draws power over this pin. 3 ntrst Output JTAG Reset. Output from Flasher to the Reset signal of the target JTAG port. Typically connected to ntrst of the target CPU. This pin is normally pulled HIGH on the target to avoid unintentional resets when there is no connection. 5 TDI Output JTAG data input of target CPU. It is recommended that this pin is pulled to a defined state on the target board. Typically connected to TDI of target CPU. 7 TMS Output JTAG mode set input of target CPU. This pin should be pulled up on the target. Typically connected to TMS of target CPU. 9 TCK Output JTAG clock signal to target CPU. It is recommended that this pin is pulled to a defined state of the target board. Typically connected to TCK of target CPU. 11 RTCK Input Return test clock signal from the target. Some targets must synchronize the JTAG inputs to internal clocks. To assist in meeting this requirement, you can use a returned, and retimed, TCK to dynamically control the TCK rate. 13 TDO Input JTAG data output from target CPU. Typically connected to TDO of target CPU. 15 RESET I/O Target CPU reset signal. Typically connected to the RESET pin of the target CPU, which is typically called nrst, nreset or RESET. 17 N/C N/C This pin is not connected on the target side of the isolator. 19 N/C N/C This pin is not connected on the target side of the isolator.

83 83 CHAPTER 7 Adapters Pins 4, 6, 8, 10, 12, 14, 16, 18, 20 are connected to GND J-Link Needle Adapter Why to choose the J-Link Needle Adapter: No additional connector required on your PCB Very small footprint High reliability spring pins for secure connections Designed with 3 locating pins, so the adapter can not be connected the wrong way No external power supply required! The J-Link Needle Adapter comes with the option to power the target hardware via J-Link. These features make the J-Link Needle Adapter the perfect solution for production purposes. The pinout of the J-Link Needle Adapter is based on the pinout of the needle adapter by TagConnect. Please note, that both pinouts are not identical since the J-Link Needle Adapter comes with a 5V-supply pin. As you can see on the image below, the three locating pins ensure, that the adapter cannot be connected to the PCB the wrong way. Moreover, the two legs on each side of the connector guarantee a stable and secure contact between pins and the PCB. The J-Link Needle Adapter can be connected to Flasher Secure via the 20-pin 0.1 JTAG to a 10-pin needle connector.